CN1267834C - Identity card identifier for Internet device - Google Patents

Identity card identifier for Internet device Download PDF

Info

Publication number
CN1267834C
CN1267834C CNB021269645A CN02126964A CN1267834C CN 1267834 C CN1267834 C CN 1267834C CN B021269645 A CNB021269645 A CN B021269645A CN 02126964 A CN02126964 A CN 02126964A CN 1267834 C CN1267834 C CN 1267834C
Authority
CN
China
Prior art keywords
data
user
password
special use
section
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related
Application number
CNB021269645A
Other languages
Chinese (zh)
Other versions
CN1407471A (en
Inventor
杰拉德·约汉·德克尔
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Ai Dide Technology Co., Ltd.
Original Assignee
Irdeto BV
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Irdeto BV filed Critical Irdeto BV
Publication of CN1407471A publication Critical patent/CN1407471A/en
Application granted granted Critical
Publication of CN1267834C publication Critical patent/CN1267834C/en
Anticipated expiration legal-status Critical
Expired - Fee Related legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Storage Device Security (AREA)
  • Computer And Data Communications (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Communication Control (AREA)
  • Signal Processing For Digital Recording And Reproducing (AREA)

Abstract

In a method for verifying the identity of a user of a first device (1) connected to a second device (2) through a data link (3), the user is provided with a user-specific password (8). The method includes transmitting user-specific data from the first device (1) to the second device (2) and comparing at least part of the data with data on the second device (2). The password data size exceeds the amount of data that the data link (3) is capable of transferring within a pre-determined interval of time. The user-specific data transmitted from the first device (1) to the second device (2) comprises one or more subsections (9, 10) of the user-specific password (8) provided to the user. A system comprising a first device (1) connected to a second device (2) through a data link (3) employs such a method. Computer programs allow programmable processing devices to function as the first (1) or second device (2).

Description

Be used for the authentication of interconnect device
Technical field
The present invention relates to a kind of method and system, be used to verify the identity that is connected to first user who installs of second device by a data link.
Background technology
Such method is used to, for example, and a user's of a pay television system of checking identity, the perhaps visitor's of the website of limiting access identity.In these cases, be necessary to verify user or visitor's identity.Have only those users that receive certain broadcast singal that paid just should be allowed to do like this.Similarly, have only those computer users that have the access right of website just should be allowed to visit this website.
User's the current techique that is used for a device of recognition network requires him that a password is provided exactly.Mechanism in the second device back will compare with a copy the record that is kept at it from the password that this user receives, so that verify his identity.
Such system depends on this user's good will.If this user's decision makes his password can be used for unwarranted third party, then this third party may pretend to be the user's of first device identity.
Network as the Internet provides a kind of relatively easy mode that data are used by the public.So, the user of a malice in network may make his password become the public and can both use, and makes that the system of trusting this password is dangerous.
A kind of method around this problem provides changing password to the user exactly.Each requests verification all requires the user that a different password is provided.Yet, owing to must from a tabulation, generate or select password, thus this method may be trouble with time-consuming.
Summary of the invention
The present invention can prevent the unwarranted shared of password.
According to an aspect of the present invention, a kind of method that is connected to second first user's who installs who installs identity by data link that is used to verify is provided, wherein, the password of user's special use is provided to this user, this method comprises from first device to the data of the second device transmission by user's special use of the password generation of user's special use, and in second device, at least a portion and the reference data of the data of described user's special use compared, wherein, the size of data of the password of described user's special use surpasses the data volume that data link can transmit in the preset time interval, and wherein, use a segment information of user's special use to generate each section conduct of described password or password with reference to data.
According to another aspect of the present invention, a kind of system that is connected to first device of second device by data link that contains is provided, wherein, first device is configured to the data that produce user's special use from the password of user's special use, and the data of this user's special use are sent to second device, second device is configured at least a portion of the data of described user's special use and reference data is compared, wherein, the size of data of the password of described user's special use surpasses the data volume that data link can transmit in the preset time interval, and wherein, second device is configured to and uses a segment information of user's special use to generate each section conduct of described password or password with reference to data.
The described time interval is selected as extreme length, makes the sharing of password thus, for example, by copying a storage medium to, perhaps transmits by the network as the Internet, does not have attractive force.
Use very long password to provide extra security to a system.When using method of the present invention,, comprise one or more son sections of the user's specific password word that provides to the user to the customer-specific data of the second device transmission from first device for fear of long proof procedure.So, the checking to user identity does not need to transmit whole password.This makes proof procedure carry out sooner and does not bother.
Second device can send the request about some section of password to first device.In a preferred embodiment of the method according to this invention, these parts are selected with random fashion.This just provides the security at the listener-in.Eavesdropping to communication between first device and second device will can not disclose enough information, make the listener-in can not continue to pretend to be the user of first device.
Can be a data carrier, for example the user to first device provides whole password on CD or the DVD disc.Can use a kind of method of standard that this data carrier is carried out Copy Protection.
Description of drawings
The present invention will be described in more detail now with reference to all accompanying drawings, wherein:
Fig. 1 is a synoptic diagram, and an example of the system of the method according to this invention is implemented in expression,
Fig. 2 represents a step in the method according to this invention, wherein, has generated the password of user's special use,
Fig. 3 is a schematically process flow diagram, and it has embodied an example of the method according to this invention, and this illustrates during a user's of checking first device identity, some important steps that taken place in second device.
Embodiment
Fig. 1 represents to use a computer network of the method according to this invention.One first device 1 is a computing machine in network in this example, directly or indirectly is connected to one second device 2, makes data to be sent to another from one of them.In this certain embodiments, second device is a server.First device is connected to second device 2 by a data link 3.Data link 3 can be a network as the LAN (Local Area Network), a kind of dial-up connection, and perhaps a kind of the Internet connects.
A user of first device 1 wishes login, so that for example from second device or other the device retrieving files that connected from network.Provide available password, comprised a very long Bit String to this user.This password is unique to the user.In addition, the method that can also use certain that user is connected with password.This may be one group of code in the part of very long Bit String, perhaps a user name, perhaps computing machine 1 sign.
In the certain embodiments of Fig. 1, in the data carrier 4 of taking the CD form, provide available password to the user.Also can use the data carrier of any other type.When first device 1 when being a computing machine, data carrier can be, for example, and a flexible plastic disc, DVD disc or a box tape.Be connected to first device 1, perhaps as first device a, part of 1 be certain device 5, in order to read password.In Fig. 1, this is a CD Player, but it also may be a DVD player, perhaps is suitable for certain other devices of the content of sense data carrier 4.
For fear of user's content of copies data carrier 4 directly, it is coupled with Copy Protection.This resist technology possibility for example, comprises some bad sector are arranged at CD 4.Most of CD write devices all can not be handled the data from bad sector.Second device 2 can keep a record of each bad sector.Just exempted thus being included in the request of one section password in the bad sector.
Fig. 2 is shown schematically in the generation of password in a preferred embodiment of the present invention.To the user is that a unique source code 6 is sent to password generator 7.Password generator 7 is a randomizer preferably.But it also is understandable that password generator 7 uses some other algorithm.Password generator 7 generates the password 8 of user's special use, comprises a very long Bit String.In a step of the method according to this invention, the son section 9,10 of the password 8 of user's special use can be selected for from first device 1 and send to second device 2.
The length of password and size of data thereof were just determined by its publisher before this system is set.In order to determine the length of password 8, it is important having two standards at least.
In the system of Fig. 1, first standard is exactly the capacity of data link 3.In other system, lead to capacity good standard normally of the fastest data link of a typical computing machine in network.If this computing machine is connected to the Internet, then the speed of the Internet link will become conclusive standard.Because password has the potential danger that causes havoc in this approach of diffusion on the Internet, so a main aspect of the present invention prevents that exactly password from spreading by the Internet.The password size of data is selected like this, makes it to surpass the interior at certain time intervals data volume that can transmit of data link 3.The selected long enough that gets of this certain time interval is shared password to stop users.In a such self-contained network of image pattern 1, this may be the thing of several hrs.If this computing machine can be connected to the Internet, then can select a longer interval, for example, 10-12 hour.Under any circumstance, this time interval should long enough, makes that downloading whole password 8 is not have attractive force terrifically.
Second standard is exactly the memory capacity that the data carrier 4 of available password 8 is provided to the user thereon.Under the situation of CD-ROM, its maximal value is about 640Mb.Using all told of carrier 4 is favourable so that the highest security level to be provided.This method is not set the upper limit of Bit String length.
Why be like this, by watching Fig. 3, this problem is just clear, in Fig. 3, has described a schematically process flow diagram of an embodiment of method of the present invention.When the figure shows a user's (for example, computing machine 1 user in Fig. 1) who works as checking first device 1 identity, some important step that in second device 2, is taken place.
After data carrier 4 had been inserted into CD Player, device 5 was read password, and first device 1 sends a logging request, and it is received at first step 11 by second device 2.This request or keyed in by the user may be used one section helper, perhaps when CD or data carrier 4 are inserted into reader that is connected with first device 1, is automatically produced by helper.Logging request can provide information about this user or first device, 1 identity to second device 2, makes this user to connect with password 8.
The method that alternatively, may comprise a kind of identifying user from the selected son section 9,10 of first device, 1 password that sends 8.Under latter event, one or more son sections 9,10 of password contain a group id code, in order to identify this user.Second device 2 can take out this group code immediately from relevant section, with it this user is linked to correct reference data.
Because password 8 is so long, to such an extent as to can't in any rational time interval, pass through data link 3 with its transmission, so, will be less by first device 1 in size to the selected sub-section 9,10 of the passwords 8 of second device, 2 transmissions.Can set total size of data of selected son section 9,10 in advance.Preferably, it is selected like this, makes whole verification process short as much as possible, the security that still keeps proper level simultaneously, as above when Fig. 1 is discussed cited.
In a preferred embodiment, when at every turn must identifying user identity, in second step 12, second device 2 be just selected different son sections 9,10.Since meet the different son section 9,10 of all using password 8 each time, thus be captured in the son section 9,10th that is sent in the once meeting, nonsensical.Listener-in 1 ', 1 on data link " still can't in once follow-up meeting, pretend to be this user.In order further to improve level of security, second device 2 can be chosen as son section 9,10 at random and send.
Share among the independent embodiment of spendable the method according to this invention in the unquestioned occasion at password, this respect allows to use short password.Owing to all select different son sections when needing identifying user identity, at every turn so listener-in 1 ', 1 " still need to eavesdrop first device 1 and second a large amount of the communicating by letter of installing between 2, to determine whole password.Therefore, this aspect of the present invention is no matter password how long, all by using a password to carry out any method of authentication, has strengthened security.
The another kind of embodiment of this method also is possible, and wherein, the user of first device 1 just can ask login by only sending the selected part of password 8.This will be for the user provides bigger easy to use, because he only needs device 5 that data carrier 4 is inserted in order to read password, to start authentication process itself.One section helper on first device 1 is handled all the further communications with second device 2.
When the user does not generate logging request on one's own initiative, the request that is received in first step 11 also will contain his identification presentation.In this case, just the step of describing 12 can be omitted, unless need the further exchange of the son section 9,10 of password 8.In such an embodiment of this method, for example, because always identical son section 9,10 are sent out, perhaps since they be according to first the device 1 or it the user can with certain algorithm be selected, so, son section 9,10th to be sent is determined well in advance.
In step 12, selected after the son section 9,10 to be asked, at next procedure 13, to the request of first device, 1 transmission about these specific sub-sections 9,10.First device 1 is searched this a little section 9,10 of password 8 immediately, and they are mail to second device 2.In the above-mentioned another kind of embodiment of this method, wherein comprise each son section of password from the request of first device 1, this step 13 can be omitted.
Follow-up step 14 is features of the common method of all embodiment that can expect.In step 14, second device 2 receives the son section 9,10 of password 8 from first device 1.
Now, each that has received section must compare with each reference field.The step 15 that all contains at all embodiment of the present invention, in 15 ', second device 2 takes out or generates each reference field.In a preferred embodiment of the invention, second device 2 is not preserved a complete copy that is used for the password 8 of comparison to be removed.Would rather in meeting each time, generate password 8 or selected son section 9,10, and subsequently with its deletion, to save storage space.For each son section 9,10 of necessity of generating password 8, use this user's of sign information.This information can, for example, be used to take out a source code 6 of user's special use of storage separately, for the usefulness of password generator 7.Alternatively, this information can comprise the source code 6 of user's special use.
In an alternative embodiment, wherein, user's identity is comprised among each section of the password that receives from first device 1, carries out to take out or each section of generation password is used for the step 15 of comparison ' added a step 16 before.Step 16 comprises the user's who determines first device 1 identity.When each section that will receive compares with each appropriate reference field, will use this identity.
Each follow-up step 17,18,19 couples of all embodiment of the present invention are common, wherein, compare with each reference field from first each section 9,10 that installs 1 password 8 that receives, and in step 18, this user's identity is confirmed as vacation, perhaps passes through authentication in another step 19, and this depends on the result.
If all regenerated each reference field of password 8 when carrying out this method by second device 2 at every turn, then this method comprises an additional step 20 of deleting these reference fields.So just saved the storage space of second device 2.Also make have the people want in second device 2, to search password 8 or its each section become impossible.
The professional person will recognize that the present invention is not limited to each above-mentioned embodiment, in the scope of claims, can change these embodiment in several ways.For example, can provide password to the user by by means of some other mode beyond the data carrier.Equally, can pass through multiple different technologies, the data carrier that contains password is carried out Copy Protection.

Claims (14)

1, be used for checking and be connected to the method for identity that first of second device (2) installs the user of (1) by data link (3), wherein, the password (8) of user's special use is provided to this user, this method comprises from first device (1) to the data (9 of second device (2) transmission by user's special use of password (8) generation of user's special use, 10), and in second device (2) with the data (9 of described user's special use, 10) at least a portion and reference data compare, wherein, the size of data of the password of described user's special use (8) surpasses the data volume that data link (3) can transmit in the preset time interval, and wherein, use a segment information (6) of user's special use to generate each section (9,10) conduct of described password (8) or password (8) with reference to data.
2, method according to claim 1 is characterized in that, one or more son sections (9,10) of the password (8) of the user's special use that provides to the user are provided to the customer-specific data of second device (2) transmission from first device (1).
3, method according to claim 1, wherein, second device (2) is to the request of first device (1) transmission at the particular segment (9,10) of password (8).
4, method according to claim 3, wherein, requested each section is chosen with random fashion.
5, method according to claim 3, wherein, first device (1) is in response to producing requested each section (9,10) from the request of second device (2) from password (8).
6, method according to claim 1, wherein, customer-specific data (9,10) comprises a segment information (6) of described user's special use.
7, method according to claim 1, wherein, the user who goes up to first device (1) in a data carrier (4) provides password (8).
8, method according to claim 7, wherein, for the data carrier (4) of storing password (8) is set up Copy Protection.
9, method according to claim 8, wherein, it is unreadable that the protection of data carrier is comprised that the some parts that makes data carrier (4) becomes, and wherein, second device (2) keeps a record of unreadable each section of passwords (8).
10, method according to claim 1 wherein, is sent an authorization requests from first device (1) to second device (2), thereby is generated the reference data of at least a portion of the password (8) that contains user's special use.
11, contain the system that is connected to first device (1) of second device (2) by data link (3), wherein, first device (1) is configured to the data (9 that produce user's special use from the password (8) of user's special use, 10), and with the data (9 of this user's special use, 10) send to second device (2), second device (2) is configured to the data (9 with described user's special use, 10) at least a portion and reference data compare, wherein, the size of data of the password of described user's special use (8) surpasses the data volume that data link (3) can transmit in the preset time interval, and wherein, second device (2) is configured to a segment information (6) that uses user's special use and generates each section (9,10) conduct of described password (8) or password (8) with reference to data.
12, system according to claim 11, also comprise the device (5) that is connected to first device (1), in order to read password (8), wherein, first device (1) contains such device, and it is reading the just automatic afterwards subscriber authentication process that starts of password (8).
13, first device (1), be used for being connected to second device (2) by data link (3), wherein, first device (1) is configured to the data (9 that produce user's special use from the password (8) of user's special use, 10), and with the data (9 of this user's special use, 10) send to second device (2), with data (9 with described user's special use, 10) at least a portion and reference data compare, wherein, the size of data of the password of described user's special use (8) surpasses the data volume that data link (3) can transmit in the preset time interval, and wherein, first device (1) is configured to a segment information (6) that sends user's special use to second device (2), this information (6) is used to generate each section (9,10) conduct of described password (8) or password (8) with reference to data.
14, second device (2), be used for being connected to first device (1) by data link (3), described second device (2) is configured to from the data (9 of first device (1) reception by user's special use of password (8) generation of user's special use, 10), and with the data (9 of described user's special use, 10) at least a portion and reference data compare, wherein, the size of data of the password of described user's special use (8) surpasses the data volume that data link (3) can transmit in the preset time interval, and wherein, second device (2) is configured to a segment information (6) that uses user's special use and generates each section (9,10) conduct of described password (8) or password (8) with reference to data.
CNB021269645A 2001-07-26 2002-07-25 Identity card identifier for Internet device Expired - Fee Related CN1267834C (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
EP01202865.0 2001-07-26
EP01202865A EP1280035A1 (en) 2001-07-26 2001-07-26 Identity verification for use with interconnected devices

Publications (2)

Publication Number Publication Date
CN1407471A CN1407471A (en) 2003-04-02
CN1267834C true CN1267834C (en) 2006-08-02

Family

ID=8180715

Family Applications (1)

Application Number Title Priority Date Filing Date
CNB021269645A Expired - Fee Related CN1267834C (en) 2001-07-26 2002-07-25 Identity card identifier for Internet device

Country Status (10)

Country Link
US (1) US20030023883A1 (en)
EP (1) EP1280035A1 (en)
JP (1) JP2003141082A (en)
CN (1) CN1267834C (en)
BR (1) BR0202869A (en)
CA (1) CA2395027A1 (en)
MX (1) MXPA02007245A (en)
NZ (1) NZ520401A (en)
TW (1) TWI256222B (en)
ZA (1) ZA200205804B (en)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7222365B2 (en) * 2004-02-26 2007-05-22 Metavante Corporation Non-algorithmic vectored steganography
CN104573826A (en) * 2013-10-15 2015-04-29 星闻互动媒体有限公司 On-line real-time video watching reservation system
CA3017401C (en) * 2015-03-12 2019-12-31 Eyelock Llc Methods and systems for managing network activity using biometrics

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5596639A (en) * 1993-07-26 1997-01-21 Elonex Ip Holdings Ltd. Cd-prom
US5771291A (en) * 1995-12-11 1998-06-23 Newton; Farrell User identification and authentication system using ultra long identification keys and ultra large databases of identification keys for secure remote terminal access to a host computer
US5812764A (en) * 1997-01-30 1998-09-22 International Business Machines Password management system over a communications network
US6026491A (en) * 1997-09-30 2000-02-15 Compaq Computer Corporation Challenge/response security architecture with fuzzy recognition of long passwords

Also Published As

Publication number Publication date
US20030023883A1 (en) 2003-01-30
ZA200205804B (en) 2003-02-21
JP2003141082A (en) 2003-05-16
EP1280035A1 (en) 2003-01-29
TWI256222B (en) 2006-06-01
CA2395027A1 (en) 2003-01-26
BR0202869A (en) 2003-06-03
CN1407471A (en) 2003-04-02
MXPA02007245A (en) 2004-08-11
NZ520401A (en) 2003-06-30

Similar Documents

Publication Publication Date Title
US9842230B1 (en) System and method for automatically detecting and then self-repairing corrupt, modified or non-existent files via a communication medium
US7406708B2 (en) System and method for serving content over a wide area network
US7134138B2 (en) Methods and apparatus for providing security for a data storage system
US7500099B1 (en) Method for mitigating web-based “one-click” attacks
JP3763393B2 (en) COMMUNICATION SYSTEM, TERMINAL DEVICE, RECORDING MEDIUM RECORDING REPRODUCTION PROGRAM, SERVER DEVICE, AND RECORDING MEDIUM RECORDING SERVER PROGRAM
US6802000B1 (en) System for authenticating access to online content referenced in hardcopy documents
US7877497B2 (en) On-demand media streaming from a user's own library to a receiving device of the user
US20060080415A1 (en) Methods and apparatuses for automatically synchronizing a profile across multiple devices
CN1201247C (en) Method for operating internet site supplying encrysted content
EP1244998A1 (en) Method and apparatus for providing secure authentication of portable devices through internet host servers
CN1507203A (en) Method and system for conducting user verification to sub position of network position
US8850563B2 (en) Portable computer accounts
JP3660274B2 (en) Method and system for automatically tracking certificate genealogy
US7536550B2 (en) Image forming apparatus and control method for same
CN1773519A (en) Method and system for monitoring content
GB2377523A (en) User identity verification system
CN1267834C (en) Identity card identifier for Internet device
JPH10260939A (en) Client machine authentication method of computer network, client machine, host machine and computer system
US20040243828A1 (en) Method and system for securing block-based storage with capability data
JP2003167854A (en) Service providing device, service providing method, computer-readable recording medium, and computer program
JP2005346120A (en) Network multi-access method and electronic device having biological information authentication function for network multi-access
JP2003526153A (en) How to service network-based storage sites
US20080307232A1 (en) Method and a System for Authenticating and Recording Digital Documents and/or Files
WO2001071638A1 (en) An internet storage service system and method
KR100286146B1 (en) Method for automatically performing log-on using integrated circuit card

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant
C56 Change in the name or address of the patentee

Owner name: IRDETO B.V.

Free format text: FORMER NAME: IRDETO B. V.

CP01 Change in the name or title of a patent holder

Address after: Holland Hoofddorp

Patentee after: Irdeto B.V.

Address before: Holland Hoofddorp

Patentee before: Irdeto B. V.

C56 Change in the name or address of the patentee

Owner name: IRDETO B. V.

Free format text: FORMER NAME: IRDETO B.V.

CP01 Change in the name or title of a patent holder

Address after: Holland Hoofddorp

Patentee after: Ai Dide Technology Co., Ltd.

Address before: Holland Hoofddorp

Patentee before: Irdeto B.V.

CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20060802

Termination date: 20150725

EXPY Termination of patent right or utility model